From fc6d00a1116d3f9caee7199ebb5c26dba8877538 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Wed, 20 Aug 2025 21:07:43 +0200
Subject: [PATCH] add note on pkcs8 structures import with choices

---
 index.html | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/index.html b/index.html
index c8745bf..a8bd1b1 100644
--- a/index.html
+++ b/index.html
@@ -1738,6 +1738,11 @@ <h5>Import Key</h5>
                       then [= exception/throw =] a
                       {{DataError}}.
                     </p>
+                    <p class=note>
+                      The import operation shall accept `ML-KEM-512-PrivateKey`, `ML-KEM-768-PrivateKey`, or `ML-KEM-1024-PrivateKey`
+                      structures in either one of the three CHOICEs (seed-only, private-only, or both). The absence of a seed
+                      or presence of the expanded private key is not a reason to [= exception/throw =] a {{DataError}}.
+                    </p>
                   </li>
                   <li>
                     <p>
@@ -2081,6 +2086,14 @@ <h5>Export Key</h5>
               cannot be accessed, then [= exception/throw =] an {{OperationError}}.
             </p>
           </li>
+          <li>
+            <p>
+              If the <a data-cite="webcrypto#dfn-CryptoKey-slot-type">`[[type]]`</a> internal slot
+              of |key| is "`private`" and an ML-KEM seed cannot be resolved from the
+              <a data-cite="webcrypto#dfn-CryptoKey-slot-handle">`[[handle]]`</a>
+              internal slot of |key|, then [= exception/throw =] an {{OperationError}}.
+            </p>
+          </li>
           <li>
             <dl class="switch">
               <dt>If |format| is {{KeyFormat/"spki"}}:</dt>
@@ -2892,6 +2905,11 @@ <h5>Import Key</h5>
                       then [= exception/throw =] a
                       {{DataError}}.
                     </p>
+                    <p class=note>
+                      The import operation shall accept `ML-DSA-44-PrivateKey`, `ML-DSA-65-PrivateKey`, or `ML-DSA-87-PrivateKey`
+                      structures in either one of the three CHOICEs (seed-only, private-only, or both). The absence of a seed
+                      or presence of the expanded private key is not a reason to [= exception/throw =] a {{DataError}}.
+                    </p>
                   </li>
                   <li>
                     <p>
@@ -3225,6 +3243,14 @@ <h5>Export Key</h5>
               cannot be accessed, then [= exception/throw =] an {{OperationError}}.
             </p>
           </li>
+          <li>
+            <p>
+              If the <a data-cite="webcrypto#dfn-CryptoKey-slot-type">`[[type]]`</a> internal slot
+              of |key| is "`private`" and an ML-DSA seed cannot be resolved from the
+              <a data-cite="webcrypto#dfn-CryptoKey-slot-handle">`[[handle]]`</a>
+              internal slot of |key|, then [= exception/throw =] an {{OperationError}}.
+            </p>
+          </li>
           <li>
             <dl class="switch">
               <dt>If |format| is {{KeyFormat/"spki"}}:</dt>